Skip to content
SprayDocs Open the app

Privacy

Privacy Policy

Effective date: September 26, 2026. Replaces the version dated August 21, 2026.

Overview

SprayDocs (“SprayDocs,” “we,” “us”) is a recordkeeping tool that helps pesticide applicators and their firms complete and keep pesticide application records. This policy explains what information we collect, how we use it, where it is stored, and the choices you have. Questions any time: hello@spraydocs.com.

Information we collect

Account information. Your email address. Sign-in is a 6-digit code we email you; there is no password to store, and we never see your email account’s password.

Firm information. The company name, license details, address, and crew membership your firm enters to fill out its records.

Spray records. The contents of the application records your firm creates: products, rates, sites, equipment, applicator names and license numbers, and customer names and service addresses. This information is entered by your firm, belongs to your firm, and is processed by us solely to provide the service.

Billing information. If your firm subscribes to a paid plan, Stripe processes the payment. Card numbers never touch our servers; we keep Stripe’s customer and subscription identifiers, the plan, and the billing dates.

Usage events. To learn which parts of SprayDocs are used, the app sends us a small set of first-party events — a record was created, a PDF was downloaded, a plan was upgraded — with the state, the plan, the language, a random device identifier this browser minted for itself (cleared with your site data), your firm’s id when you are signed in, and a few per-event facts such as which prompt was shown. No IP address, browser fingerprint, page URL, email address or record content is included, we use no third-party analytics, and the app sends nothing when your browser signals Global Privacy Control.

Update requests. If you ask to be kept posted from a state guide or the help page, we keep the email address you entered, which page you asked from, and the language, so the update can go out in it. Those forms are protected by Cloudflare Turnstile (below), which decides whether the submission came from a person; we never see what it looked at. We keep the address until you tell us to stop — reply to any such email, or write to hello@spraydocs.com, and it is removed.

Technical basics. Standard server logs (such as IP address and request time) needed to run and secure the service. We do not run advertising trackers or analytics that profile you, and we do not sell personal information.

Where your data lives

Records you create are saved on your own device as you type, so losing coverage in the middle of a record loses nothing; after its first visit the app itself opens without a connection, because your browser keeps a copy of it (a service worker) on the device. Without an account, that is the only place they exist: nothing you type is sent to our servers. When you are signed in, records also sync to our servers so your devices — and, on a firm plan, your crew and office — see the same history. Two optional helpers on the record form send your device’s location out when you tap them, and only then: “Use GPS for Address” sends it to OpenStreetMap’s Nominatim service (with Photon as a fallback) to look up the street address, and “Load Current Temp/Wind” sends it to the U.S. National Weather Service (api.weather.gov) to find the nearest station’s reading. The PDF itself is generated on your device.

Our servers use these service providers, each processing data on our behalf:

  • Supabase — database and sign-in (data stored in the United States, Oregon region), encrypted at rest.
  • Railway — hosts our application programming interface.
  • Vercel — hosts the SprayDocs app and this website.
  • Our email provider (Supabase’s sender today; a dedicated sender at spraydocs.com as we move to it) — delivers the sign-in codes and any email you ask for.
  • Stripe — payments and subscription billing for paid plans.
  • Cloudflare Turnstile — tells the “keep me posted” forms a person, not a script, pressed the button. It runs only on those pages, and only the form’s token reaches our servers.

All traffic between your device and our servers is encrypted in transit (TLS).

How we use information

To provide the service: creating, syncing, exporting, and safeguarding your firm’s records; signing you in; billing paid plans; sending the emails you request (sign-in codes and notifications you asked for); understanding which features are used, through the first-party events above; and keeping the service secure and reliable. We do not use your records for advertising, and we do not sell or rent personal information to anyone.

Your customers’ information

Spray records naturally include your customers’ names and service addresses. Your firm controls that information; we process it only to store, sync, and print your records. If one of your customers asks about their data, we will refer them to your firm.

Record history

Because spray records are compliance documents, SprayDocs keeps an append-only history of changes to each record: edits create new entries rather than silently rewriting the past, and the history notes who made a change and when. This is a feature of the audit trail your records may need to stand on.

How long we keep data

We keep a copy of every record synced to your account for 7 years from the day it was created — the longest retention period any state requires — on every plan, including the free plan. A free account can open records from the last 14 days; older records remain stored in your archive, counted but not deleted, and a paid plan opens them again. Nothing is deleted when a paid plan ends: the firm returns to the free plan with its archive intact, or may choose the Lite plan to keep the whole history open. The statutory duty to retain application records belongs to the applicator and the firm, not to SprayDocs. Export your PDFs and backup files as you go; every plan can export the records it opens, and Pro and Lite open the archive. If you ask us to delete your account, we delete the personal information associated with it and the firm’s records within a reasonable time after confirming the request, except where we must keep a record for billing, security or legal reasons. Because deletion ends our copy of your records, we will confirm the request with the firm’s owner and offer a final export first.

Your choices and rights

  • Export the records your plan opens at any time from within the app (the PDF for each record and a backup file); Pro and Lite open the whole archive.
  • Correct record contents at any time; the audit history preserves what changed.
  • Ask us to delete your account and associated personal information by emailing hello@spraydocs.com.
  • Unsubscribe from any update emails at any time by replying or using the link in the email. Sign-in codes are sent only when you ask for one.
  • Turn on Global Privacy Control in your browser and the app sends no usage events.

Security

Encryption in transit and at rest, code-based sign-in with short-lived tokens, restricted database roles, daily database backups, and an append-only record history. No system is perfectly secure, but we design so that losing a phone does not mean losing — or leaking — your records.

Children

SprayDocs is a tool for working pesticide applicators and their firms. It is not directed to children, and we do not knowingly collect personal information from anyone under 18.

Changes to this policy

If we change this policy in a meaningful way, we will update the date above and, for significant changes, note it in the app or by email. Continued use of SprayDocs after a change means the updated policy applies.

Contact

SprayDocs · Washington, USA · hello@spraydocs.com

See also: Terms of Service. SprayDocs is an independent product. It is not affiliated with or endorsed by any state agency.